EulerOS Virtualization 2.10.1 : curl (EulerOS-SA-2026-1109)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(297359);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/31");

  script_cve_id("CVE-2025-0725", "CVE-2025-9086", "CVE-2025-10966");
  script_xref(name:"IAVA", value:"2025-A-0085-S");
  script_xref(name:"IAVA", value:"2025-A-0657-S");
  script_xref(name:"IAVA", value:"2025-A-0818-S");

  script_name(english:"EulerOS Virtualization 2.10.1 : curl (EulerOS-SA-2026-1109)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS Virtualization host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is
affected by the following vulnerabilities :

    curl's code for managing SSH connections when SFTP was done using the wolfSSH
    powered backend was flawed and missed host verification mechanisms.

    This prevents curl from detecting MITM attackers and more.(CVE-2025-10966)

    When libcurl is asked to perform automatic gzip decompression of
    content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,
    **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would
    make libcurl perform a buffer overflow.(CVE-2025-0725)

    1. A cookie is set using the `secure` keyword for `https://target`
    2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear
    text HTTP) using the same cookie set
    3. The same cookie name is set - but with just a slash as path (`path='/'`).Since this site is not secure,
    the cookie *should* just be ignored.
    4. A bug in the path comparison logic makes curl read outside a heap buffer boundary

    The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets
    the clear-text site override the contents of the secure cookie, contrary to expectations and depending on
    the memory contents immediately following the single-byte allocation that holds the path.

    The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was
    already set as secure on a secure host so overriding it on an insecure host should not be
    okay.(CVE-2025-9086)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization curl security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-1109
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?885d8c32");
  script_set_attribute(attribute:"solution", value:
"Update the affected curl packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-9086");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2025-0725");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/12/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/31");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:curl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libcurl");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:uvp:2.10.1");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (uvp != "2.10.1") audit(AUDIT_OS_NOT, "EulerOS Virtualization 2.10.1");
if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);

var flag = 0;

var pkgs = [
  "curl-7.71.1-4.h31.r6.eulerosv2r10",
  "libcurl-7.71.1-4.h31.r6.eulerosv2r10"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "curl");
}